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GCHQ metadata 



• GCHQ now creating metadata on: 

- SSL/TLS 

- IKE 

- OpenVPN 

- SSH 

- SQUEAL signatures (Various crypt packages) 

• Data available in BEARDED PIGGY and/or the 
CLOUD 
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How can Network Analysis help ? 



• Can NAC help 
make sense using 
network 

knowledge of the 
volumes of data to 
isolate that which 
we want to 
decrypt... 



Seek 







Sense 



c 




SnarT^ 





TOP SECRET//REL TO USA, AUS, CAN, GBR, NZL 



TOP SECRET STRAP 2 // REL TO USA, AUS, CAN, GBR, NZL 

The Seed Approach 



• Intercepted documentation reveals details of VPN set up. . . 
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The Seed Approach 



• Turn Seed IP into network block 

• Query on network block against metadata 

• Chain outwards / fuzzy subnet logic 

• Basis of NTAT developed tradecraft: 

- IRASCIBLE HARE 

- IRASCIBLE RABBIT 

- IRASCIBLE MOOSE 

- IRASCIBLE EMITT 
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Known usage 



• Target known to use encryption 

- Identify target subnet 

- Select on subnet against metadata 

• Or... 

- Start with an AS - look for most interesting wheel 

- BELGACOM - AS6774 - known to run GRX links to MNO 
over VPN 
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Network Knowledge enrichment 



• Internet Registry information 

• IP Geolocation 

• DNS 

• Data derived from network device configuration files 
(routers/Firewalls etc) 

• Network information on surrounding IPs (i.e. rest of subnet is 
MNO related) 




n/\c 



This information is exempt from disclosure under the Freedom of Information Act 2000 and may be subject to exemption under other UK information 
legislation. Refer disclosure requests to GCHQ o BHHHHHHHHHflHHHHHHflHHHHHHH 



REL TO USA, AUS, CAf 



R, NZL 





TOP SECRET//REL TO USA, AUS, CAN, GBR, NZL 



TOP SECRET STRAP 2 // REL TO USA, AUS, CAN, GBR, NZL 

Access Optimisation 



• A given role of Network Analysis is optimising access for a given 
problem - in this case enabling two-ended collection 

• Or Identifying opportunities to get at the data before it is 

encrypted therefore no need to make sense of encrypted data. 
Can do this both: 

- Passive 

- Active 
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Your Idea’s Please 






